fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d

General

Target

NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
Size

285KB
MD5

4db1b428d0e115a810836f937d786f38
SHA1

35e8722f5bf1997d6022fa512f60458470a8999e
SHA256

fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
SHA512

091491e4cb375eceadcff843cef080815b1f802e0182d260d750f7afc8197eb09461ed9b119b04eff0839c627d2630bfb1e9409de0da12086e2d15bb12565109
SSDEEP

6144:mlVD0j3qci00ei4m4d3hJkuRi7g9BOu6xb4YnDy:X2cibT4d3hJLUWwu6F4YW

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

description	pid	process	target process
PID 2892 set thread context of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2608 2716 WerFault.exe NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

pid process

2892 NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

description pid process

Token: SeDebugPrivilege 2892 NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

pid	pid_target	process	target process
2608	2716	WerFault.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

pid	process
2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

description	pid	process
Token: SeDebugPrivilege	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exeNEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892

C:\Users\Admin\AppData\Local\Temp\NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
2⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 164
3⤵
- Program crash
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2716-15-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2892-4-0x0000000000C30000-0x0000000000C64000-memory.dmp

Filesize
208KB

Download
memory/2892-1-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-17-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-0-0x0000000000E20000-0x0000000000E6E000-memory.dmp

Filesize
312KB

Download
memory/2892-5-0x0000000000DD0000-0x0000000000E1C000-memory.dmp

Filesize
304KB

Download
memory/2892-3-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2892-2-0x0000000000560000-0x00000000005A6000-memory.dmp

Filesize
280KB

Download

description	pid	process	target process
PID 2892 wrote to memory of 2632	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2632	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2632	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2632	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2892 wrote to memory of 2716	2892	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe
PID 2716 wrote to memory of 2608	2716	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	WerFault.exe
PID 2716 wrote to memory of 2608	2716	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	WerFault.exe
PID 2716 wrote to memory of 2608	2716	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	WerFault.exe
PID 2716 wrote to memory of 2608	2716	NEAS.fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623dexe_JC.exe	WerFault.exe

Analysis

Sharing